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Art Unit: 2122 



DETAILED ACTION 



Response to Arguments 

1 . Applicant's arguments filed 05 MARCH 2001 have been fully considered but they are not 
persuasive. 



2. The amendment filed 05 MARCH 2001 is objected to under 35 U.S.C. 132 because it 
introduces new matter into the disclosure. 35 U.S.C. 132 states that no amendment shall 
introduce new matter into the disclosure of the invention. The added material which is not 
supported by the original disclosure is as follows: 

Claims 31, 32, 41, and 42 introduce an "accuracy measure" that was not previously 
disclosed. 

Claims 33 and 43 introduce the re-training of the neural network, which was not 
previously disclosed. 

Applicant is required to cancel the new matter in the reply to this Office action. 



Specification 
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Claim Rejections - 35 USC § 101 
3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

the invention as disclosed in claims 1-6, 8, 10-23, and 30-39 is directed to non-statutory subject 
matter. While the claims are in the technological arts, they are not limited to practical 
applications in the technological arts. 

Specifically, the claims are a series of steps to be performed on a computer, but they 
disclose ideas abstractly from any particular practical application. 

To Constitutionally interpret the word "process", the Supreme Court has held that: 

"*** A process is a mode of treatment of certain materials to produce a given result. It is an act, or a series of acts, 
performed upon the subject matter to be transformed and reduced to a different state or thing. *** The process requires 
that certain things should be done with certain substances, and in a certain order, but the tools to be used in doing this 
may be of secondary consequence." (emphasis added) Diamond, Commissioner of Patents and Trademarks v. Diehr and 
Lutton, 209 USPQ 1,6 (1981) quoting Cochrane v. Deener, 94 U.S. 780, 787-788 (1876). 

This Constitutional interpretation of the word "process" is a long-standing one that the 
Supreme Court requires to be applied in interpreting 35 USC 101. Diamond v. Diehr at 6. 
Consequently, the use of that interpretation is Constitutionally required when we interpret the 
Federal Circuit's standard that a"new and useful process" is one that produces a "useful, 
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concrete, and tangible result". Cf. State Street Bank & Trust Co. v. Signature Financial Group, 
Inc., 47 USPQ2d 1596, 1600-1601 (Fed. Cir. 1998). 

Applicant discloses no "certain substances" that have been "transformed or reduced" in 
that Applicant's claims disclose no specific computer-readable medium, no manipulation of 
specific data representing physical objects or activities (pre-computer activity), nor do they 
disclose any specific independent physical acts being performed by the invention (post-computer 
activity). 

The claims merely manipulate abstract ideas in general without limitation to a practical 
application where "certain substances" are transformed or reduced. 

4. On this basis, claims 1-6, 8, 10-23, and 30-39 are rejected under 35 USC 101. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



Application/Control Number: 08/925, 1 86 Page 5 

Art Unit: 2122 

6. Claim 1-6, 8, 10-30, 34-40, and 44-45 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hunt et al. (U.S. Patent Number 5,365,574; Dated 1 1/1 5/1994; Class 379; 
Subclass 88.02) in view of Gillick et al. (U.S. Patent Number 4,837,831 ; Dated 06/06/1989; 
Class 704; Subclass 245). 

Claim 1 

Hunt et al. Discloses the following aspects of the claimed invention: 
Claim l's "(i) storing information relating to the transmission of messages by the entity 
over a given time period, " is anticipated by Hunt et al col. 5, lin. 1-3, where it recites: 

"Random access memory ("RAM") 44 is connected to the CPU by bus 32 for 
providing temporary storage of data processed thereby." 

Claim l's "(") creating a signature comprising a plurality of parameters related to the 
transmission of messages over that time period wherein the parameters comprise at least one 
parameter related to the transmission of messages over a portion of the period and also related to 
the position of the portion in the period, to enable output data to be derived from the stored 
information;" is anticipated by Hunt et al col. 7, lin. 15-21, where it recites 

"In particular, as speech is input to the system 14, a feature extractor 60 
extracts a set of primary features that are computed in real time every 10 
milliseconds. The primary features include heuristically-developed time domain 
features (e.g., zero crossing rates) and frequency domain information such as Fast 
Fourier Transform ("FFT") coefficients. " 
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Art Unit: 2122 

Claim l's "(vi) processing the signatures using the anomaly detector to derive the 
anomalies by detecting unexpected patterns in the transmission of messages by the entity over 
the time period." is anticipated by Hunt et al col. 8, lin. 9-54. 

Claim l's "(v) detecting anomalies by inputting the signatures to the anomaly detector; 
and" is anticipated by Hunt et al col. 8, lin. 9-54. 

Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 

Claim l's "(n) creating a second signature comprising a plurality of 
parameters related to the transmission of messages over a second period shorter than 
the first and more recent than the first;" 

Claim l's "(m) updating the first signature by a weighted averaging with 
the second signature;" 

Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 
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It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation - The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 1 . 

Claim 2 

Claim 2's "a method as claimed in claim 1 wherein the first signature is created in one of 
a plurality of possible formats." is anticipated by Hunt et al col. 8, lin. 10-46. 



Claim 3's "a method as claimed in claim 2 wherein the format of the first signature 
comprises the length of the signature." is anticipated by Hunt et al col. 9, lin. 18-20 where it 
recites "d(i) is the resultant weighted Euclidean distance measure for the ith digit in the current 
password entry sequence." This is the Euclidean length of the vector. 



Claim 3 
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Art Unit: 2122 

Claim 4 

Claim 4 f s "a method as claimed in claim 1 wherein said at least one parameter represents 
the number of events made in the portion of the first time period as a proportion of the 
total number of events made in the whole first time period." is anticipated by Hunt et al col .7, 



Claim 5's "a method as claimed in claim 1 wherein said at least one parameter represents 
the number of events of a predetermined type made in the whole first time period as a proportion 
of the total number of events made in the whole first time period." is anticipated by Hunt et al 
col. 7, lin. 17-26. 



Claim 6's "storing information about each of a number of events which occurred during 
the first time period;" is anticipated by Hunt et al col. 7, lin. 17-30. 

Claim 6's "selecting attributes from this information; and" is anticipated by Hunt et al 
col. 7, lin. 17-30. 

Claim 6's "converting the attributes into first said signature." is anticipated by Hunt et al 
col. 7, lin. 17-30. 



lin. 17-20. 



Claim 5 



Claim 6 



Claim 8 
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Claim 8's "A method as claimed in Claim 1 wherein said anomaly detector comprises a 
neural network." is anticipated by Hunt et al col. 9, lin. 28-47; col. 7, lin. 64-68. 



Hunt et al discloses the features of the claims 10, 1 1, 20, and 21, but Hunt et al does not 
expressly disclose the use of a predictive model. 

Gillick et al discloses that the use of a predictive model produces a more accurate output. 



It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the predictive model from Gillick et al in Hunt et al. 

Motivation — A more accurate output would have been a highly desirable feature in the 
detection art due to its efficiency and Gillick et al recognizes that a more accurate system would 
be expected when the predictive model of Gillick et al is substituted for the conventional 
signatures of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claims 10, 1 1, 20, and 2 1 . 



Claims 10, 11,20, and 21 



"frames comprised of linear predictive coding parameters can be used with the 
present invention instead of frames of spectral parameters" Gillick et al, col. 32, 



lin. 25-27. 



Claim 12 
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Hunt et al. Discloses the following aspects of the claimed invention: 

Claim 12's "(i) a data store arranged to store information relating to the transmission of 

messages by the entity over a given time period," is anticipated by Hunt et al col. 5, lin. 1-3, 

where it recites: 



Claim 12's "(ii) an input arranged to receive information about each of a number of 
events which occurred during the time period;" is anticipated by Hunt et al col. 7, lin. 14-16. 

Claim 12's "(iv) an anomaly detector;" is anticipated by Hunt et al col. 7, lin. 35-41. 

Claim 12's "(v) an input arranged to provide the signatures to the anomaly detector, and " 
is anticipated by Hunt et al col. 7, lin. 30-35. 

Claim 12's "(vi) wherein the anomaly detector is arranged to process the signatures to 
derive the anomalies by detecting unexpected patterns in the transmission of messages by the 
entity over the time period." is anticipated by Hunt et al col. 7, lin. 30-41. 

Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 
"(ii) a processor arranged to convert the information into a signature 



comprising a plurality of parameters related to the transmission of messages over the 
time period wherein the parameters comprise at least one parameter related to the 
transmission of messages over a portion of the period and also related to the position 
of the portion in the period, to enable output data to be derived from the stored 
information and wherein said processor is further arranged to convert at least part of 



"Random access memory ("RAM") 44 is connected to the CPU by bus 32 for 
providing temporary storage of data processed thereby." 




• 
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the information into a second signature, comprising a plurality of parameters 
related to the transmission of messages over a second period, shorter than the first 
and more recent than the first; and also to update the first signature by a weighted 
averaging with the second signature;" 



Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 

It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 
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would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 12. 



Hunt et al discloses the conventional use of neural networks to detect anomalies in voice 

data. 

Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature. 

Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 



Claim 13-19 and 22 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



and a shorter updating signature. 




# 
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It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claims 13-19 and 22. 



Claim 22's "an input arranged to receive information about the transmission of messages 
by the entity;" is anticipated by Hunt et al col. 7, lin. 15-17. 

Claim 22's "an anomaly detector; " is anticipated by Hunt et al col. 8, lin. 9-67. 

Claim 22 ? s "an input arranged to provide the signatures to the anomaly detector, and 
wherein said anomaly detector is arranged to process the signatures to derive the anomalies by 
detecting unexpected patterns in the transmission of message by the entity over the time period." 
is anticipated by Hunt et al col. 8, lin. 9-67. 



Claim 22 
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Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 



"a processor arranged to create a first signature comprising a plurality of 
parameters related to the transmission of messages over a predetermined first time 
period and to create a second signature comprising a plurality of parameters related 
to the transmission of messages over a second period shorter than the first and more 
recent than the first;" is anticipated by Hunt et al col. 7, lin. 15-17. 

"a processor arranged to calculate a weighted averaging of the first and 
second signatures to form an updated first signature;" is anticipated by Hunt et al 
col. 7, lin. 64-68. 



Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 



It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 
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Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 22. 



related to the associated telephone calls over that time period," is anticipated by Hunt et al col. 7, 
lin. 15-21, where it recites 



"In particular, as speech is input to the system 14, a feature extractor 60 
extracts a set of primary features that are computed in real time every 10 
milliseconds. The primary features include heuristically-developed time domain 
features (e.g., zero crossing rates) and frequency domain information such as Fast 
Fourier Transform ("FFT") coefficients." 



Claim 23 



Claim 23's "(i) 



creating a first signature comprising a plurality of parameters 



Claim 23's "(iv) inputting the signatures to the anomaly detector; and " is anticipated by 
Hunt et al col. 8, lin. 9-54. 




# 
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Claim 23's "( v ) processing the signatures using the anomaly detector to derive the 
potentially fraudulent telephone calls by detecting unexpected patterns in the telephone calls 
associated with the entity over the time period." is anticipated by Hunt et al col. 8, lin. 9-54. 

Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 

(ii) creating a second signature comprising a plurality of parameters related to the 
associated telephone calls over a second period shorter than the first and more recent 
that the first; 

(iii) updating the first signature by a weighted averaging with the second signature; 

Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 
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It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation -- The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 23. 

Claim 24 

24. A method as claimed in claim 23 wherein the first signature is created in one of a 
plurality of predetermined possible formats." is anticipated by Hunt et al col. 7, lin. 17-26. 



25. A method as claimed in claim 24 wherein the format of the first signature comprises the 
length of the signature." is anticipated by Hunt et al col. 9, lin. 18-20 where it recites "d(i) is the 
resultant weighted Euclidean distance measure for the ith digit in the current password entry 
sequence." This is the Euclidean length of the vector. 



Claim 25 
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Claim 26 



26. A method as claimed in claim 23 wherein at least one parameter of the first signature is 
related to the transmission of messages over a portion of the period and also related to the 
position of the portion in the period." is anticipated by Hunt et al col. 7, lin. 15-21, where it 



"In particular, as speech is input to the system 14, a feature extractor 60 
extracts a set of primary features that are computed in real time every 10 
milliseconds. The primary features include heuristically-developed time domain 
features (e.g., zero crossing rates) and frequency domain information such as Fast 
Fourier Transform ("FFT") coefficients." 



27. A method as claimed in claim 26 wherein said at least one parameter represents the 
number of events made in the portion of the first time period as a proportion of the total number 
of events made in the whole, first time period." is anticipated by Hunt et al col .7, lin. 17-20. 



28. A method as claimed in claim 26 wherein said at least one parameter represents the 
number of events of a predetermined type made in the portion of the first time period as a 
proportion of the total number of events of the same type made in the whole first time period." is 
anticipated by Hunt et al col. 7, lin. 17-26. 



recites 



Claim 27 



Claim 28 



Claim 29 
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29. A computer system for detecting potentially fraudulent telephone calls from telephone 
calls associated with an entity over time, the system comprising: 

Claim 29's "(0 an input arranged to receive information about the telephone calls 
associated with the entity;" is anticipated by Hunt et al col. 7, lin. 15-21, where it recites 

"In particular, as speech is input to the system 14, a feature extractor 60 
extracts a set of primary features that are computed in real time every 10 
milliseconds. The primary features include heuristically-developed time domain 
features (e.g., zero crossing rates) and frequency domain information such as Fast 
Fourier Transform ("FFT") coefficients." 



Claim 29's "(iii) an anomaly detector;" is anticipated by Hunt et al col. 8, lin. 9-54. 

Claim 29's "(i v ) an input arranged to provide the signatures to the anomaly detector; and 
wherein said anomaly detector is arranged to process the signatures to derive the potentially 
fraudulent telephone calls by detecting unexpected patterns in the telephone calls associated with 
the entity over the predetermined time period." is anticipated by Hunt et al col. 8, lin. 9-54. 

Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 

(ii) a processor arranged to create a first signature comprising a plurality of 
parameters related to the telephone calls over a predetermined first time period and 
to create a second signature comprising a plurality of parameters related to the 
telephone calls over a second period shorter than the first and more recent than the 
first; and wherein the processor is arranged to calculate a weighted averaging of the 
first and second signatures to form an updated first signature; 
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Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 

It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



Application/Control Number: 08/925,186 
Art Unit: 2122 



Page 



Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 29. 



Claim 30 

Claim 30's "(i) monitoring traffic flowing in the network," is anticipated by Hunt et al 
col. 8, lin. 9-54. 



Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 

Claim 30's "(ii) generating a normal historic signature and a stored historic 
signature each representative of network usage over a first time period, 

Claim 30's "(m) generating a current signature representative of network 
usage over a second time period which is shorter and more recent than the first time 
period, 

Claim 30's "(' v ) determining whether the current signature represents 
normal usage by comparing it with the normal historic signature, 

Claim 30's "(iv) if the current signature is determined to represent normal 
usage, producing an updated stored historic signature by combining the stored 
historic signature and the current signature using a weighted averaging procedure so 
that consistent trends present in the current signature are gradually over time 
introduced into the longer term trends incorporated in the stored historic signature, 

Claim 30's "(vi) providing an indication of anomalous network usage if the 
present usage as represented by the current signature deviates from that represented 
by the normal historic signature by more than a predetermined amount." 



Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 
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"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 

It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 30. 



Claim 34 
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Claim 34's "A method according to claim 30, wherein the network is a 
telecommunications network and the traffic flowing in the network is selected form the group of 
voice and data traffic." is anticipated by Hunt et al, Title. 



Claim 35's "A method according to claim 30, wherein the network is a cellular mobile 
telecommunications network and the traffic flowing in the network includes traffic flowing 
between a mobile station and a base station forming part of the network." is inherent in Hunt et 
al, Title because cellular phones are by definition devices that operate over the phone network - 
that is why it is called cellular — PSTN elements that are called "cell sites" connect these phones 
to the PSTN via wireless connection. 

Claim 36 

Claim 36's "A method according to claim 30, wherein the current, historic and stored 
historic signatures are generated by parsing and analysing call data records (CDR) in a 
telecommunications network." is anticipated by Hunt et al, claim 1 , where it recites: 



"1 . A method for enabling a caller to obtain access to one or more services via a 
telephone network by speaking a password having a plurality of characters, 
comprising the steps of: 

establishing at least one predetermined threshold value for a speaker 
verification signal; 



Claim 35 
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generating first and second sets of parameters for each spoken character 
using a voice recognition feature transformation and a voice verification feature 
transformation, respectively, the first sets of parameters for use in a voice 
recognition system and the second sets of parameters for use in a voice verification 
system; 

recognizing the password using the first sets of parameters; 

following entry of the password, using the second sets of parameters to 
generate a speaker verification signal for the password; 

adjusting the predetermined threshold value upon a predetermined call 
condition; 

determining whether the speaker verification signal for the password has a 
predetermined relationship with respect to the adjusted threshold value; and 

if the speaker verification signal for the password has a predetermined 
relationship with respect to the adjusted threshold value, accepting the caller's 
identity." 



Claim 37's "A method according to claim 30, wherein each current signature and each 
historic signature is associated with an individual network user." is anticipated by Hunt et al, 
claim 1, where it recites: 



"1 . A method for enabling a caller to obtain access to one or more services via a 
telephone network by speaking a password having a plurality of characters, 
comprising the steps of: 

establishing at least one predetermined threshold value for a speaker 
verification signal; 

generating first and second sets of parameters for each spoken character 
using a voice recognition feature transformation and a voice verification feature 
transformation, respectively, the first sets of parameters for use in a voice 
recognition system and the second sets of parameters for use in a voice verification 
system; 

recognizing the password using the first sets of parameters; 

following entry of the password, using the second sets of parameters to 
generate a speaker verification signal for the password; 

adjusting the predetermined threshold value upon a predetermined call 
condition; 

determining whether the speaker verification signal for the password has a 
predetermined relationship with respect to the adjusted threshold value; and 



Claim 37 





Application/Control Number: 08/925,186 



Page 25 



Art Unit: 2122 



if the speaker verification signal for the password has a predetermined 
relationship with respect to the adjusted threshold value, accepting the caller's 
identity." 



Claim 37 is further anticipated by Hunt et al, col. 12, lin. 35-38 



"...the voice recognition algorithm 48 could alternatively be speaker-dependent 
instead of speaker-independent as described in the preferred embodiment." 



Claim 38 



Claim 38's "A method according to claim 30, comprising training a neural network to 
recognise the difference between current signatures which represent normal and anomalous usage 
of the network." is anticipated by Hunt et al col. 9, lin. 28-47; col. 7, lin. 64-68. 



Claim 39's "A method according to claim 30, wherein the step of comparing present 
usage with the current and historic signatures is carried out by at least one pre-trained neural 
network." is anticipated by Hunt et al col. 9, lin. 28-47; col. 7, lin. 64-68. 

Claim 40 

Claim 40's "(0 a traffic data input arranged to receive traffic data representative of traffic 
flowing in the network," is anticipated by Hunt et al col. 8, lin. 9-54. 



Claim 39 
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Hunt et al, however, does not expressly disclose the updating of the first signature by 
making a weighted average with a second updating signature disclosed as follows: 

Claim 40's "(ii) a historic signature generator arranged to process the traffic 
data and to generate a normal historic signature and a stored historic signature each 
representative of network usage over a first time period, 

Claim 40's "(in) a current signature generator arranged to process the 
traffic data to generate a current signature representative of network usage over a 
second time period which is shorter and more recent than the first time period, 

Claim 40's "(iv) an anomaly detector arranged to determine whether the 
current signature represents normal usage by comparing it with the normal historic 
signature and further arranged to produce an updated stored historic signature by 
combining the stored historic signature and the current signature using a weighted 
averaging procedure so that consistent trends present in the current signature are 
gradually over time introduced into the longer term trends incorporated in the stored 
historic signature, if the current signature is determined to represent normal usage, 
and 

Claim 40's "(v) an anomaly output arranged to provide an indication of 
anomalous network usage if the anomaly detector determines that present network 
usage as represented by the current signature deviates from that represented by the 
normal historic signature by more than a predetermined amount." 



Gillick et al discloses in claim 5 that the use of an updating step that uses a weighted 
average between the longer historical signature with a shorter updating signature produces a 
weighted composite signature of the time series data: 



The prior art reference did not limit the relative sizes of the time frames in the claim, so the 
broadest reasonable interpretation of the art encompasses the use of a longer historical signature 
and a shorter updating signature. 



"...said comparing includes deriving a series of smoothed frames from said sequence 
of individual frames, each of said smoothed frames being derived from a weighted 
average of a plurality of individual frames, and comparing at least one of said 
smoothed frame against said cluster models" (emphasis added.) 
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It would have been obvious to a person of ordinary skill in the art, at the time the 
invention was made, to use the updating method from Gillick et al in Hunt et al. 

Motivation — The ability to more heavily weight certain portions of the historical 
signature data would have been a highly desirable feature in the recognition art due to its ability 
to allow one to pay more attention to more relevant time periods in the signal and Gillick et al 
recognizes that the ability to more heavily weight certain portions of the historical signature data 
would be expected when the updating method of Gillick et al is substituted for the conventional 
signature of Hunt et al. 

Therefore, it would have been obvious, to one of ordinary skill in the art, to combine 
Gillick et al with Hunt et al to obtain the invention as specified in claim 40. 

Claim 44 

44. A method according to claim 40, wherein the traffic data are call data records (CDR) in a 
telecommunications network." is anticipated by Hunt et al, claim 1, where it recites: 



"1 . A method for enabling a caller to obtain access to one or more services via a 
telephone network by speaking a password having a plurality of characters, 
comprising the steps of: 

establishing at least one predetermined threshold value for a speaker 
verification signal; 

generating first and second sets of parameters for each spoken character 
using a voice recognition feature transformation and a voice verification feature 
transformation, respectively, the first sets of parameters for use in a voice 
recognition system and the second sets of parameters for use in a voice verification 
system: 

recognizing the password using the first sets of parameters; 
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following entry of the password, using the second sets of parameters to 
generate a speaker verification signal for the password; 

adjusting the predetermined threshold value upon a predetermined call 
condition; 

determining whether the speaker verification signal for the password has a 
predetermined relationship with respect to the adjusted threshold value; and 

if the speaker verification signal for the password has a predetermined 
relationship with respect to the adjusted threshold value, accepting the caller's 
identity." 



45. A method according to claim 40, wherein the historic and current signature generators are 
arranged to associate each respective current signature and historic signature with an individual 
network user." is anticipated by Hunt et al, claim 1, where it recites: 



"1 . A method for enabling a caller to obtain access to one or more services via a 
telephone network by speaking a password having a plurality of characters, 
comprising the steps of: 

establishing at least one predetermined threshold value for a speaker 
verification signal; 

generating first and second sets of parameters for each spoken character 
using a voice recognition feature transformation and a voice verification feature 
transformation, respectively, the first sets of parameters for use in a voice 
recognition system and the second sets of parameters for use in a voice verification 
system; 

recognizing the password using the first sets of parameters; 

following entry of the password, using the second sets of parameters to 
generate a speaker verification signal for the password; 

adjusting the predetermined threshold value upon a predetermined call 
condition; 

determining whether the speaker verification signal for the password has a 
predetermined relationship with respect to the adjusted threshold value; and 

if the speaker verification signal for the password has a predetermined 
relationship with respect to the adjusted threshold value, accepting the caller's 
identity." 



Claim 45 



Claim 45 is further anticipated by Hunt et al, col. 12, lin. 35-38 
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"...the voice recognition algorithm 48 could alternatively be speaker-dependent 
instead of speaker-independent as described in the preferred embodiment." 



7. In the Remarks, Applicant argues, in substance, that: 



"The Examiner has rejected all the pending claims as being obvious in view of Hunt 
and Gillick. It is noted that both of these prior art documents are concerned only 
with voice recognition over a telecommunications network whereas the present 
invention as recited explicitly in all of the pending and new claims is concerned 
with the detection of anomalies which are often defined as irregular or 
abnormal occurrences (such as fraudulent activity). Thus the prior art cited by 
the Examiner is concerned with recognizing patterns in digitized data streams 
representing speech which is in absolute contrast with the present invention which is 
concerned with detecting irregularities or abnormalities (i.e. disruptions in patterns) 
in an otherwise normal sequence of messages. Thus not only is the prior art cited by 
the Examiner in a different technical field to that of the present invention but it 
teaches the reverse of the present invention. The skilled artisan would see no 
connection whatsoever between time and frequency domain analyses of digitized 
voice data and the detection of anomalies such as fraud in a sequence of messages." 



Examiner disagrees. The prior art is concerned with the detection of unauthorized access 
on the network. Hunt et ah, col. 2, lin. 14-25 discloses the following: 



"In a preferred embodiment, these and other objects of the invention are 
provided in a method for enabling a caller to obtain access to services via a 
telephone network by entering a spoken password having a plurality of digits. 
Preferably, the method begins by prompting the caller to speak the password 
beginning with a first digit and ending with a last digit thereof. Each spoken digit of 
the password is then recognized using a speaker-independent voice recognition 
algorithm. Following entry of the last digit of the password, a determination is made 
whether the password is valid. If so, the caller's identity is verified using a voice 
verification algorithm ." 



Conclusion 



Furthermore, Hunt et ah, col. 2, lin 62-68; col. 3, lin. 1-6 discloses 
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" The voice verification routine is controlled by the digital processor and is 
responsive to a determination that the password is valid for determining whether 
the caller is an authorized user. This routine includes transformation means that 
receives the speech feature data generated for each digit and the voice verification 
feature transformation data and in response thereto generates voice verification 
parameter data for each digit. A verifier routine receives the voice verification 
parameter data and the (speaker-relative) voice verification class reference data and 
in response thereto generates an output indicating whether the caller is an 
authorized user ." 



Since unauthorized access is not a normal use of the network, it is well within Applicant's 
definition of "anomalies" cited above. Specifically, Applicant defines "anomalies" as "irregular 
or abnormal occurrences." Unauthorized access in the network is clearly not a normal intended 
use of the network. It is an "abnormal occurrence" and clearly is an "anomaly" as defined by 



"Examiner's assertion that the word "entity" as used in claims 1,12 and 13 is the use 
of the word abstract from any particular attributes is respectfully traversed. The 
"entity" as recited in these claims has the ability to transmit messages over a given 
time period and thus it has the attributes of being able to transmit for longer than an 
instant. The transmission of messages is a technical occurrence and furthermore is a 
concrete occurrence . 

The Examiner comments that it is not clear what entity is limited to. It is noted that 
in for example the State Street Bank case it was considered appropriate to limit the 
claims to financial transactions. It was appropriate in that case because the State 
Street Bank invention was itself related to financial transactions. The present 
invention has applications for example in credit card fraud and fraudulent use of 
telecommunications equipment ." 



Applicant. 



II. 



Examiner disagrees. In re Warmerdam is within the Alappat — State Street Bank — AT&T 
line of cases. The standard used by the Federal Circuit in that case is binding on Examiner's 
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actions. The fact that the transformation of "discrete dollar values" was held to be statutory does 
not allow for the transformation of abstract "entity" data to be statutory. 

Applicant calls the "transmission of messages" a "technical occurrence" and is, therefore 
statutory. Examiner finds no "technical occurrence" element in Federal Circuit or Supreme 
Court doctrine on 101. The discoveries of natural phenomena or of mathematical properties are 
also "technical occurrences", but warrant absolutely no patent protection. Information 
transmission, in the abstract, is purely a mathematical endeavor, as evidenced by the vast, 
seminal body of work created by the very, very well known mathematician Claude Elwood 
Shannon. Applicant's argument is unpersuasive. 

8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 
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9. Any inquiry concerning this communication or earlier communications from the 
Examiner should be directed to Wilbert L. Starks, Jr. whose telephone number is (703) 305-0027. 
Alternatively, inquiries may be directed to Supervising Patent Examiner Mark Powell whose 
telephone number is (703) 305-9703. 



WLS 

May 1 7, 2001 MARK R. POWELL 



SUPERVISORY PATENT EXAMINER 
GROUP 2700 



